Vulnerabilities CVE-2026-72780

CVE-2026-72780

High

Open

TLP:CLEAR

Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.

Details

CVSS Score: 7.1
EPSS Score ⓘ: 0.23%

13.5th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Confidence: 90%
Published: Aug 11, 2026
Last Modified: Aug 11, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.